Internal audit risk assessment where audit hours follow the risks that moved, with every score traced to its source
Audit hours follow the risks that moved, with every score traced to its source.
See one case, screen by screen ↓Internal Audit Risk Assessment builds the annual risk-based audit plan from cited risk signals, for audit leaders. Eight agents read board minutes, the risk register, incidents, KRIs, new rules and prior findings, propose score moves for each auditable entity with the passage behind them, argue against the big ones and fit the plan to the team's hours and skills. The Chief Audit Executive decides, moves the cut line and signs.
How to choose AI solutions for back-office and enterprise work →
Updated
Every year the Chief Audit Executive has to show the audit committee which parts of the business internal audit will look at, and why. The IIA's Global Internal Audit Standards ask for a risk-based plan resting on a documented assessment, done at least annually, with input from the board and senior management. In most audit functions that assessment is a spreadsheet of auditable entities, scored by hand from interviews, a survey and the auditors' memory, months before the plan year starts. The inputs sit with other teams: board minutes, the enterprise risk register, the incident system, KRIs, the contract register and last year's reports.
So scores become opinions. One loud interview or one news story moves an entity, and when the chair asks why third-party risk is higher than last year, nobody can point to the document that moved it. Then the business moves in the year — a new outsourcer, a vendor incident, a new Topical Requirement — and the plan only catches up at the next cycle, while every hour spent on a low-risk audit is an hour not spent on a high-risk one.
Estimated split of the audit team's working days for one annual risk assessment, by hand and with the solution. The stakeholder interviews are still held by people.
Eight agents read the evidence, propose cited score moves, argue against the big ones and fit the plan to the hours; the CAE signs.
Kestrel & Vane Group — a diversified group of about 40,000 people in 30 countries — has 48 auditable entities in six domains. It is 14 October 2026; the 2027 plan goes to the audit committee on 2 December. Here is what happens next, screen by screen, in the working solution.
Ingrid's home is simple: four numbers — 6 entities moved 10+ points, plan v1 at 6,720 of 6,800 hours, 6 of 7 entities scored 70+ in the plan, committee in 49 days — and the agents' messages, each with its sources and a button. The challenger disputes three readers; the interview agent has drafted a reminder for an overdue interview; the operations reader says the ethics hotline sync failed at 23:00.
Planner: “Third-party risk management is ready for you. It moved from 42 to 78 on three cited signals … Accept it and I will swap it in for travel and expenses, inside 6,800 hours.”
The audit universe is ranked by this year's score, with last year's beside it and the signals that moved it as short cited chips. Third-party risk management, last audited Nov 2023, sits at rank 3: 42 to 78, +36. On the right the 2027 plan fills its hours bar, and the planner shows what would happen if she accepts: third-party risk in at +360 h, travel and expenses out at −320 h.
Filters for what an audit chief asks first: moved 10+ (6), needs a person (7), in plan (20), not audited 3+ years.
The entity view splits the score across the six factors of the method: impact 12 to 18 of 25, likelihood and change 6 to 18 of 20, control environment 10 to 18 of 20, regulatory exposure 5 to 15 of 15. The governance reader proposes +14 for a new payroll outsourcer handling bank and tax details for 9,400 employees; the operations reader +12 for a May vendor incident; regulatory watch +10 for the IIA Third-Party Topical Requirement, in force 15 Sep 2026.
The CFO's interview, quoted: “we have no assurance yet over their controls and their SOC report is not due until March.”
She clicks a citation and reads the source: incident report INC-2026-0417, §5 Root cause and actions, page 6. The highlighted lines say there is no periodic review of vendor portal access, and that 41 other vendors operate portals holding Kestrel & Vane data, with access reviews due by 31 December 2026. Below it: exactly what the agent took from the page.
A read-only copy of every passage used is kept with the assessment.
The challenger contested the incident: the freight vendor was offboarded on 30 June, so the event looks closed. It re-read the root cause, found it still open across 41 vendors, and withdrew — +12 holds. On payroll it had already caught double counting: the outsourcer is scored in third-party risk, so payroll keeps +13, not +18.
Challenger: “I contested the Q2 vendor incident … The cause is open. I withdraw; +12 holds.” It can contest a score; it can never change one.
Ingrid accepts all three signals with the reason code “Evidence sound”, and the score becomes 78. The planner proposes the trade-off in the open: third-party risk management in, 360 hours, Fatima Rahman with Aisha Bello in Q1; travel and expenses out, 52 and 320 hours — the lowest score above the line, a Satisfactory 2025 audit with no open findings, and every claim tested automatically since January.
“Plan v2: 20 engagements, 6,760 of 6,800 hours.” She approves the swap; the cut line moves.
Three moves are still argued both ways. Treasury and FX: the reader says 68 on €4.1M of FX losses in six months; the challenger says 56, because the loss is inside the €6M tolerance in the hedging policy and the 2025 audit was Satisfactory. OT at plants: 69 or 64. AI use and governance: 62 or 55. She sides with one, or sets her own score with a reason.
“3 disputes wait for your ruling. The planner checked: whichever way you rule, all three stay above the line.”
The plan lists every engagement with its score, hours, quarter, lead and skills, and capacity per person: Fatima Rahman, Jonas Weber and Lukas Nowak full at 1,000 hours, Aisha Bello at 960 because third-party risk needs IT skills too, and Ashby Lane Advisory's 800 co-source hours on OT and cyber. Fleet management (51) stays below the line, recorded as a cycle-rule exception for the committee.
Planner: “Required audits and every entity scored 70+ are protected; I cannot drop them.”
The sign-off runs in order: the audit manager's review of 28 signals, the score moves and the fitted plan, the open disputes and the cycle-rule exception, then the Chief Risk Officer. Rahul Venkat concurs: “Matches the risk register — R-14 is now High too.” Ingrid signs plan v2 with the reason “Risk-based: within budget” and the meaning of her signature, and the version locks.
Meaning: “Approval of the internal audit plan for the audit committee.”
The committee writer drafts Paper 4 in seven sections — summary, what changed since last year, coverage, resources, not covered and exceptions, conformance with the Standards, approval sought — every claim cited, each section approved by Ingrid. The chair asked on the pre-read why travel and expenses drops out after scoring 61; the draft answer waits for Ingrid to edit, approve and send.
“Questions from the chair — you approve every answer.”
The same 2027 plan, seen by five of the people who carry it — what the assessment season looked like, and what it looks like now.
Eight agents read the evidence, propose cited score moves, argue against the big ones and fit the plan to the hours; the CAE signs.
Keeps the audit universe matched to the business: proposes new entities (a new business, system or law), merges and retirements such as a divested business, each with its source.
Reads board and committee minutes, strategy papers, the risk register and management changes, and proposes points per factor with the page and item that justify them.
Reads incident logs, KRIs, ethics hotline statistics, prior audit findings and open issues, and proposes cited score moves.
Tracks laws, regulator notices and the IIA Topical Requirements, and maps them to entities with the date they take effect.
Drafts each stakeholder's interview guide from their area and the signals, pulls risk statements from the notes with quotes and links them to entities, and drafts reminders for overdue interviews.
Argues the opposite case on every move of 10 points or more — stale evidence, double counting, a closed cause — and holds, reduces or disputes with its reason.
Fits engagements into the hours budget and the team's skills, keeps required audits in, and proposes the swap with its trade-off when the cut line moves — in the year as well as at plan time.
Drafts the plan paper and in-year change notes with every claim cited, checks the plan for completeness before sign-off, and drafts answers to the chair's questions.
Rules on disputes, moves the cut line, signs the plan; the chair approves. The agents propose; a named person decides.
Every screen has a conversation with the agents. Ask about an entity, the plan or the paper — or tell them what to do. Answers cite their sources and nothing changes until a person accepts.
Why did third-party risk jump to 78?
Three cited signals: Calloway Payroll Partners now processes bank and tax details for 9,400 employees; a freight vendor's portal exposed 1,212 records in May and the cause is open across 41 vendors; and the IIA Third-Party Topical Requirement took effect on 15 Sep. The challenger contested the incident and withdrew.
What needs me before the committee?
Before the committee on 2 Dec: 1 score move to accept (third-party risk, 42 → 78), 1 plan swap, 3 challenger disputes to rule, the CRO's concurrence, your signature on plan v2, and 1 question from the chair. The pack is due 18 Nov.
What falls out if I add fleet management?
Fleet management scores 51 and has not been audited since May 2021 — that breaks the rule “50 and above at least every 3 years”. To bring it in (240 h) inside 6,800 hours, the lowest-scoring engagement above the line is Product quality and recalls (53, 280 h): returns are within target and there were no recalls. Shall I propose that swap, or record the cycle exception for your sign-off?
Is the plan staffable?
Yes. With third-party risk in, everyone is inside their hours: Fatima Rahman, Jonas Weber and Lukas Nowak are full at 1,000; Aisha Bello (IT) is at 960 of 1,000 because third-party risk needs IT skills too. Ashby Lane's 800 co-source hours cover OT and cyber.
13 screens from the working solution, on its sample data. Pick one to see it large.
The method every score follows and the rules the agents work to are settings — versioned and on the audit trail.
| Setting | Default | Choose from |
|---|---|---|
| Factor weights (method v3) | Impact 25 · Likelihood and change 20 · Control environment 20 · Regulatory exposure 15 · Fraud and conduct 10 · Time since last audit 10 | Any split that adds up to 100, each factor rated 1–5; saved as a new method version |
| Challenge every move of | 10 points | Step up or down, in points |
| Bulk accept allowed up to | 3 points | Step up or down, in points; one reason covers the group |
| Evidence is stale after | 18 months | Step up or down, in months; older sources are flagged to the reader and the challenger |
| Audit every year from a score of | 70 | Step up or down; entities at or above it are protected in the plan |
| Audit at least every 3 years from | 50 | Step up or down; below the line and older becomes a recorded exception |
| In-year change goes to the chair over | 80 hours | Step up or down, in hours — or whenever an entity scored 70+ would drop |
| Reason codes for signal decisions | Evidence sound · Points overstated · Duplicate · Out of date · Not material | Add your own codes, alongside the plan-approval and in-year-change codes |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample data · “target” = the design goal, measured in the live solution · “estimated” = our estimate · “typical” = published figures (Gartner Audit Key Priorities and Risks survey — 60% of CAEs say their risk assessment moves too slowly, 44% miss critical inputs; a published university audit risk assessment timeline — information gathering February to April, approval in June). Regulatory context: IIA Global Internal Audit Standards, effective 9 Jan 2025 (Standard 9.4); IIA Third-Party Topical Requirement, effective 15 Sep 2026. People and companies named on this page are fictional — characters and sample data in the working solution.
Internal Audit Risk Assessment builds the annual risk-based audit plan from cited risk signals, for audit leaders. Eight agents read board minutes, the risk register, incidents, KRIs, new rules and prior findings, propose score moves for each auditable entity with the passage behind them, argue against the big ones and fit the plan to the team's hours and skills. The Chief Audit Executive decides, moves the cut line and signs.
Each entity in the audit universe is scored on your method — six weighted factors out of 100 by default. The readers propose points per factor from their sources, a person accepts, edits or rejects each move, and the planner fits the ranked entities into the hours budget, keeping required audits and every entity scored 70+ in, and showing what falls below the cut line.
Yes. Every score move is a cited proposal: the document, the place, the date and the highlighted passage. The universe shows last year's score, this year's and the move, and the committee paper's “What changed since last year” section cites the source of every mover.
A challenger agent argues the other side of every move of 10 points or more — stale evidence, double counting, a cause already closed. It holds, reduces or disputes with its reason, and when it disagrees with a reader both cases come to a person. It can never change a score itself.
It keeps the assessment documented and refreshed during the year: every score, decision and change is on an immutable trail with the plan version, stakeholder interviews feed the scores, and Topical Requirement applicability is recorded for each engagement in scope. An evidence pack can be exported for the quality assessment and the external auditor.
The readers keep reading. A move that crosses the cut line becomes a proposed in-year change, sized in hours, with a reason code and a cited note. Changes over 80 hours, or any that drop an entity scored 70+, go to the audit committee chair; smaller ones to the CAE.
Yes. The agents propose, cite and argue; they never change a score, add or retire an entity, drop a required audit, publish a plan or send anything to the committee. A manager decides signals, the CAE rules on disputes and signs with a reason and an e-signature, the CRO concurs and the committee approves.
The Agentic Solution Engine builds and deploys it from your requirements and documents — your audit universe, last year's scores, your method and your source systems — and it goes live once every quality gate has passed. A guided first-time setup imports the universe, connects the sources, sets the method, invites the team and runs the first assessment.
Every sample cited, re-performed and signed before your auditor asks.
1-min demoAudit Evidence CollectionEvidence checked before the auditor sees it, and the request list closed before fieldwork.
1-min demoContinuous Controls MonitoringControl failures found in a day, not at year-end, and every fix proved by a re-test.
1-min demoWe'll run Internal Audit Risk Assessment on your own audit universe, last year's scores and a sample of the minutes and reports behind them.